Virus Bursters V6.3 befall |
||
|---|---|---|
| #0
| ||
|
28.11.2006, 12:14
Member
Beiträge: 17 |
||
 
|
|
|
|
28.11.2006, 12:16
Ehrenmitglied
 Beiträge: 29434 |
#2
mansair
«« stelle den CleanUp genauso ein, wie hier angegeben: http://virus-protect.org/cleanup.html «« Kopiere diese 6 Textdateien ab . (rechtsklick mit der Maus -> den Text markieren -> kopieren -> einfügen) Sie sind nach Datum geordnet. (kopiere nur die letzten 3 Monate ab) http://virus-protect.org/datfindbat.html «« poste das log vom HjackThis http://virus-protect.org/hjtkurz.html __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
28.11.2006, 13:39
Member
Themenstarter Beiträge: 17 |
#3
Hier die benötigten Logs
danke für die Hilfe im Voraus Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: A040-88CD Verzeichnis von C:\WINDOWS\system32 28.11.2006 13:28 567'204 ghhkj.ini2 28.11.2006 13:27 58'460 LVCOMSX.LOG 28.11.2006 08:04 143 mcrh.tmp 28.11.2006 07:49 122'928 FNTCACHE.DAT 28.11.2006 07:47 566'070 ghhkj.bak2 28.11.2006 07:43 570'561 ghhkj.tmp 28.11.2006 00:00 2'206 wpa.dbl 27.11.2006 23:59 46 blue.SITENAME 27.11.2006 23:54 567'094 ghhkj.ini 27.11.2006 23:47 311'604 perfh009.dat 27.11.2006 23:47 39'992 perfc009.dat 27.11.2006 23:47 48'156 perfc007.dat 27.11.2006 23:47 316'594 perfh007.dat 27.11.2006 23:47 723'744 PerfStringBackup.INI 27.11.2006 23:46 77'824 tpedvf.dll 27.11.2006 23:46 17'920 ixt0.dll_tobedeleted 27.11.2006 23:46 4'286 ot.ico 27.11.2006 23:46 4'286 ts.ico 27.11.2006 23:45 126'996 qlujsolw.dll 27.11.2006 23:45 88'340 qbdrlhek.exe 27.11.2006 23:45 42'516 suoledgh.dll 27.11.2006 23:45 565'461 ghhkj.bak1 27.11.2006 23:45 704'564 jkhhg.dll 27.11.2006 23:40 71'168 drvlul.dll 27.11.2006 23:40 40'973 ssqpool.dll 27.11.2006 23:40 17'408 winzwr32.dll 31.10.2006 19:23 4'032 SYMEVNT1.DLL 31.10.2006 19:23 120'379 SYMEVNT.386 31.10.2006 19:23 36'864 S32EVNT1.DLL 26.10.2006 11:52 1'098 lvcoinst.log 24.10.2006 10:17 48'424 sirenacm.dll 16.09.2006 15:29 181'736 rmoc3260.dll 16.09.2006 15:29 5'632 pndx5032.dll 16.09.2006 15:29 6'656 pndx5016.dll 16.09.2006 15:29 278'528 pncrt.dll 29.08.2006 20:36 1'409 tmp9EC5F.FOT 29.08.2006 20:36 1'409 tmp33B5F.FOT 29.08.2006 20:36 1'409 tmpF495F.FOT 29.08.2006 20:36 1'409 tmpDF65F.FOT Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: A040-88CD Verzeichnis von C:\DOKUME~1\Mansair\LOKALE~1\Temp 28.11.2006 13:28 468 WCESCOMM.LOG 28.11.2006 13:28 286 WCESLog.log 28.11.2006 13:27 32'723 VBLanguage.ini 28.11.2006 13:27 16'384 ~DF8555.tmp 22.11.2006 21:27 122 2F49CE31.TMP 5 Datei(en) 49'983 Bytes 0 Verzeichnis(se), 1'025'470'464 Bytes frei Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: A040-88CD Verzeichnis von C:\WINDOWS 28.11.2006 13:27 1'643'111 WindowsUpdate.log 28.11.2006 13:27 159 wiadebug.log 28.11.2006 13:27 50 wiaservc.log 28.11.2006 13:27 0 0.log 28.11.2006 13:27 2'048 bootstat.dat 28.11.2006 13:26 32'548 SchedLgU.Txt 28.11.2006 12:03 70'103 setupapi.log 28.11.2006 00:00 238 attach.log 28.11.2006 00:00 404 VFO.VST 27.11.2006 23:46 34 VFO.INI 27.11.2006 23:45 58'132 wmsetup.log 27.11.2006 23:39 37 install_Studio10.log 27.11.2006 22:56 200'752 setupact.log 22.11.2006 18:38 74'624 ntdtcsetup.log 22.11.2006 18:38 125'903 comsetup.log 22.11.2006 18:38 404'006 iis6.log 22.11.2006 18:38 162'686 tsoc.log 22.11.2006 18:38 1'393 imsins.log 22.11.2006 18:38 20'357 KB909394.log 22.11.2006 18:38 18'109 tabletoc.log 22.11.2006 18:38 60'959 netfxocm.log 22.11.2006 18:38 182'095 ocgen.log 22.11.2006 18:38 12'513 ocmsn.log 22.11.2006 18:38 17'257 msgsocm.log 22.11.2006 18:38 345'410 FaxSetup.log 22.11.2006 18:38 110'254 msmqinst.log 22.11.2006 18:38 13'555 KB894476.log 22.11.2006 18:17 232'624 ntbtlog.txt 21.11.2006 20:38 1'393 imsins.BAK 21.11.2006 20:35 1'539'014 setupapi.log.0.old 15.11.2006 00:11 182'272 mmproxy_40.mdb 15.11.2006 00:07 77 __pp_database40.m4d_CTBL 15.11.2006 00:07 3'972 __pp_database40.m4d 14.11.2006 23:58 842 win.ini 14.11.2006 23:57 94'208 mmproxy_40_Backup.mdb 14.11.2006 23:50 316'640 WMSysPr9.prx 13.11.2006 12:52 21'418 DPINST.LOG 09.11.2006 23:18 48'640 AKDeInstall.exe 31.10.2006 19:22 1'774 EnvChecklog.txt 30.10.2006 19:20 3'284 Ascd_tmp.ini 30.10.2006 19:19 0 AS_Debug.txt 03.10.2006 21:42 1'705 musi.ini 29.09.2006 11:45 83 muserr.ini 26.09.2006 12:05 11'694 ModemLog_Nokia 6230i USB Modem.txt 25.09.2006 16:34 19 SoundConverter.INI 16.09.2006 16:49 451 brwmark.ini 10.09.2006 16:10 573 AudStu.INI 06.09.2006 14:43 500 GEARInstall.log 29.08.2006 20:39 74 MAGIX.INI Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: A040-88CD Verzeichnis von C:\WINDOWS\Temp 28.11.2006 13:31 0 win7.tmp 28.11.2006 13:31 0 win6.tmp 28.11.2006 13:31 0 win8.tmp 28.11.2006 13:29 0 win5.tmp 28.11.2006 13:29 0 win4.tmp 28.11.2006 13:27 0 win2.tmp 28.11.2006 13:27 0 win1.tmp 7 Datei(en) 0 Bytes 0 Verzeichnis(se), 1'025'449'984 Bytes frei Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: A040-88CD Verzeichnis von C:\WINDOWS\Downloaded Program Files Keine aktuellen Daten Volume in Laufwerk C: hat keine Bezeichnung. Volumeseriennummer: A040-88CD Verzeichnis von C:\ 28.11.2006 13:34 0 sys.txt 28.11.2006 13:33 1'298 down.txt 28.11.2006 13:32 549 tmp.txt 28.11.2006 13:32 10'886 system.txt 28.11.2006 13:31 495 systemtemp.txt 28.11.2006 13:28 112'004 system32.txt 28.11.2006 13:26 1'195'376'640 pagefile.sys 28.11.2006 12:11 13'971 ComboFix.txt 27.11.2006 23:46 87 AUTOEXEC.BAT 21.11.2006 23:42 13'030 PDOXUSRS.NET 10.09.2006 19:04 19 Answer.txt Logfile of HijackThis v1.99.1 Scan saved at 13:38:20, on 28.11.2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\brsvc01a.exe C:\WINDOWS\System32\brss01a.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Programme\Symantec\pcAnywhere\awhost32.exe C:\WINDOWS\System32\igfxtray.exe C:\WINDOWS\System32\hkcmd.exe C:\Programme\Intel\NCS\PROSet\PRONoMgr.exe C:\Programme\Analog Devices\SoundMAX\SMTray.exe C:\WINDOWS\System32\LVCOMSX.EXE C:\Programme\Logitech\Video\LogiTray.exe C:\Dokumente und Einstellungen\Mansair\Eigene Dateien\Downloads\XAMPP\xampp\FileZillaFTP\FileZillaServer.exe C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe C:\Programme\Java\jre1.5.0_08\bin\jusched.exe C:\Programme\Winamp\winampa.exe C:\Programme\iTunes\iTunesHelper.exe C:\Programme\Analog Devices\SoundMAX\SMAgent.exe C:\Programme\FreePDF_XP\fpassist.exe C:\WINDOWS\System32\svchost.exe C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE C:\Program Files\ASUS\Probe\AsusProb.exe C:\Programme\Logitech\Video\FxSvr2.exe C:\Programme\Virus-Bursters\virus-bursters.exe C:\WINDOWS\System32\ctfmon.exe C:\Programme\iPod\bin\iPodService.exe C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe C:\Programme\Microsoft ActiveSync\wcescomm.exe C:\Programme\Spybot - Search & Destroy\TeaTimer.exe C:\Programme\Gemeinsame Dateien\PCSuite\Services\ServiceLayer.exe C:\PROGRA~1\MICROS~3\rapimgr.exe C:\Programme\Kabelloser Labtec-Desktop\MagicKey.exe C:\PROGRA~1\GEMEIN~1\Nokia\MPAPI\MPAPI3s.exe C:\Programme\Kabelloser Labtec-Desktop\MulMouse.exe C:\Programme\Kabelloser Labtec-Desktop\OSD.EXE C:\Programme\MSN Messenger\usnsvc.exe C:\WINDOWS\System32\cmd.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\Dokumente und Einstellungen\Mansair\Desktop\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bluewin.ch/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar3.dll O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Programme\VSAdd-in\VSAdd-in.dll O3 - Toolbar: Safety Bar - {052b12f7-86fa-4921-8482-26c42316b522} - C:\Programme\Safety Bar\SafetyBar.dll (file missing) O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe O4 - HKLM\..\Run: [PRONoMgr.exe] C:\Programme\Intel\NCS\PROSet\PRONoMgr.exe O4 - HKLM\..\Run: [Smapp] C:\Programme\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Programme\Logitech\Video\ISStart.exe O4 - HKLM\..\Run: [LogitechVideoTray] C:\Programme\Logitech\Video\LogiTray.exe O4 - HKLM\..\Run: [DXM6Patch_981116] C:\WINDOWS\p_981116.exe /Q:A O4 - HKLM\..\Run: [MaxtorOneTouch] C:\PROGRA~1\Maxtor\OneTouch\Utils\OneTouch.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.5.0_08\bin\jusched.exe" O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Programme\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Programme\Gemeinsame Dateien\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup O4 - HKLM\..\Run: [ASUS Probe] C:\Program Files\ASUS\Probe\AsusProb.exe O4 - HKLM\..\Run: [CTDrive] rundll32.exe C:\WINDOWS\System32\drvlul.dll,startup O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\System32\\PSDrvCheck.exe O4 - HKLM\..\Run: [Virus-Bursters] C:\Programme\Virus-Bursters\virus-bursters.exe /h O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [LogitechSoftwareUpdate] C:\Programme\Logitech\Video\ManifestEngine.exe boot O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [PcSync] C:\Programme\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Programme\Microsoft ActiveSync\wcescomm.exe" O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programme\Gemeinsame Dateien\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Kabellosen Labtec-Desktop aktivieren.lnk = C:\Programme\Kabelloser Labtec-Desktop\MagicKey.exe O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_08\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_08\bin\ssv.dll O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra 'Tools' menuitem: Mobilen Favoriten erstellen... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~3\INetRepl.dll O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O16 - DPF: {00000000-0000-0000-0000-100005000004} - http://code.trasferimento.biz/l/bf3b6461158cc470dbc6f27a13b3bfa3_35.exe O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (myCokemusic Music Manager) - http://img.od2.com/Installation/PluginName/MusicManager/MusicManagerPlugin.CAB O16 - DPF: {DE625294-70E6-45ED-B895-CFFA13AEB044} (AxisMediaControlEmb Class) - http://87.245.83.189/activex/AMC.cab O18 - Protocol: bw+0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw+0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw-0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw00s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw10s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw20s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw30s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw40s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw50s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw60s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw70s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw80s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bw90s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwa0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwb0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwc0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwd0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwe0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwf0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll O18 - Protocol: bwg0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwg0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwh0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwi0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwj0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwk0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwl0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwm0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwn0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwo0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwp0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwq0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwr0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bws0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwt0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwu0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwv0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bww0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwx0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwy0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: bwz0s - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL O18 - Protocol: offline-8876480 - {93043D3F-EC78-44F6-83B1-5CFC568B6408} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BWPlugProtocol-8876480.dll O21 - SSODL: expatriates - {1a01a98c-4f25-42e1-971a-185cf63569b2} - C:\WINDOWS\System32\tpedvf.dll O23 - Service: pcAnywhere Host Service (awhost32) - Symantec Corporation - C:\Programme\Symantec\pcAnywhere\awhost32.exe O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\System32\brsvc01a.exe O23 - Service: FileZilla Server FTP server (FileZilla Server) - FileZilla Project - C:\Dokumente und Einstellungen\Mansair\Eigene Dateien\Downloads\XAMPP\xampp\FileZillaFTP\FileZillaServer.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Programme\Intel\NCS\Sync\NetSvc.exe O23 - Service: ServiceLayer - Nokia. - C:\Programme\Gemeinsame Dateien\PCSuite\Services\ServiceLayer.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Programme\Analog Devices\SoundMAX\SMAgent.exe |
|
|
|
|
|
|
28.11.2006, 14:29
Ehrenmitglied
Beiträge: 29434 |
#4
1.
Vundofix anwenden http://virus-protect.org/artikel/tools/vundofixx.html 2. Avenger http://virus-protect.org/artikel/tools/avenger.html kopiere rein: Zitat Registry values to delete:Klicke die gruene Ampel das Script wird nun ausgeführt, dann wird der PC automatisch neustarten »» loesche das Backup vom Avenger unter C:\Avenger\backup.zip + leere den Papierkorb «« scanne mit smitfraudfix - Option 1 und 2 ( lasse auch die Registry mitreinigen) http://virus-protect.org/artikel/tools/smitfrautfix.html «« öffne das HijackThis -- Button "scan" -- vor diese Einträge Häkchen setzen -- Button "Fix checked" -- PC neustarten Zitat O3 - Toolbar: &VSAdd-in - {74DD705D-6834-439C-A735-A6DBE2677452} - C:\Programme\VSAdd-in\VSAdd-in.dllPC neustarten ** scanne und poste den scanreport http://virus-protect.org/artikel/tools/superantispyware.html __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
28.11.2006, 20:03
Member
Themenstarter Beiträge: 17 |
#5
SUPERAntiSpyware Scan Log
Generated 11/28/2006 at 07:37 PM Application Version : 3.3.1020 Core Rules Database Version : 3137 Trace Rules Database Version: 1154 Scan type : Complete Scan Total Scan Time : 00:03:51 Memory items scanned : 523 Memory Thread detected : 0 Registry items scanned : 5574 Registry Thread detected : 17 File items scanned : 1532 File Thread detected : 1 Adware.Tracking Cookie C:\Dokumente und Einstellungen\Mansair\Cookies\mansair@atdmt[2].txt Browser Hijacker.BestSafetyGuide HKCR\CLSID\{755BBD1A-AA59-456C-AFEB-B4C42C4DCB6F} HKCR\CLSID\{755BBD1A-AA59-456C-AFEB-B4C42C4DCB6F}\InprocServer32 HKCR\CLSID\{755BBD1A-AA59-456C-AFEB-B4C42C4DCB6F}\InprocServer32#ThreadingModel Trojan.Unknown Origin HKLM\SOFTWARE\Microsoft\MSSMGR HKLM\SOFTWARE\Microsoft\MSSMGR#Data HKLM\SOFTWARE\Microsoft\MSSMGR#LSTV HKLM\SOFTWARE\Microsoft\MSSMGR#Brnd HKLM\SOFTWARE\Microsoft\MSSMGR#Rid HKLM\SOFTWARE\Microsoft\MSSMGR#LID Adware.IPWins HKU\S-1-5-21-1060284298-2111687655-1801674531-1003\Software\IpWins HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IpWins HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IpWins#DisplayName HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IpWins#UninstallString Malware.Safety Bar HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SafetyBar HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SafetyBar#DisplayName HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\SafetyBar#UninstallString Adware.VSToolbar HKU\S-1-5-21-1060284298-2111687655-1801674531-1003\Software\Search Toolbar Corp kann allerdings denn ordner "Avenger" auf C: nicht ganz löschen leider. |
|
|
|
|
|
|
28.11.2006, 23:51
Ehrenmitglied
Beiträge: 29434 |
#6
mansair
scanne mit ewido oder panda und poste hier den scanrpeort http://virus-protect.org/onlinescan.html __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
29.11.2006, 13:14
Member
Themenstarter Beiträge: 17 |
#7
__________________________________________________
ewido anti-spyware online scanner http://www.ewido.net __________________________________________________ Name: TrackingCookie.Atdmt Path: C:\Dokumente und Einstellungen\Mansair\Cookies\mansair@atdmt[1].txt Risk: Medium Name: TrackingCookie.Doubleclick Path: C:\Dokumente und Einstellungen\Mansair\Cookies\mansair@doubleclick[1].txt Risk: Medium Name: TrackingCookie.Hitbox Path: C:\Dokumente und Einstellungen\Mansair\Cookies\mansair@ehg-swisscom.hitbox[2].txt Risk: Medium Name: TrackingCookie.Hitbox Path: C:\Dokumente und Einstellungen\Mansair\Cookies\mansair@hitbox[2].txt Risk: Medium Name: TrackingCookie.2o7 Path: C:\Dokumente und Einstellungen\Mansair\Cookies\mansair@pinnaclesystems.122.2o7[1].txt Risk: Medium Name: TrackingCookie.Popularix Path: C:\Dokumente und Einstellungen\Mansair\Cookies\mansair@ppms.popularix[1].txt Risk: Medium Name: Adware.Generic Path: HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\{c95fe080-8f5d-11d2-a20b-00aa003c157a} Risk: Medium Name: Adware.Lop Path: C:\Dokumente und Einstellungen\Mansair\Eigene Dateien\Downloads\new_uninstall.exe Risk: Medium Name: Adware.SaveNow Path: C:\Dokumente und Einstellungen\Mansair\Eigene Dateien\Downloads\Programme\div-x player.exe Risk: Medium Name: Not-A-Virus.VirTool.Win32.AvSpoffer.a Path: C:\Dokumente und Einstellungen\Mansair\Eigene Dateien\Downloads\Programme\virtuosa\LS_Virtuosa_Gold_v4.10a_Phoenix_Edition_patch.exe Risk: Low Name: Not-A-Virus.VirTool.Win32.AvSpoffer.a Path: C:\Dokumente und Einstellungen\Mansair\Eigene Dateien\Downloads\Programme\virtuosa\Virtuosa 410 MP3 Center+Crk.exe/LS_Virtuosa_Gold_v4.10a_Phoenix_Edition_patch.exe Risk: Low Name: Not-A-Virus.VirTool.Win32.AvSpoffer.a Path: C:\Dokumente und Einstellungen\Mansair\Eigene Dateien\Downloads\Programme\virtuosa\virtuosa all in one crack.rar/virtuosa-all-one+crack[www.ed2kmagazine.com][Area_Soft]\LS_Virtuosa_Gold_v4.10a_Phoenix_Edition_patch.exe Risk: Low Name: Not-A-Virus.VirTool.Win32.AvSpoffer.a Path: C:\Dokumente und Einstellungen\Mansair\Eigene Dateien\Downloads\Programme\virtuosa\Virtuosa richtig\LS_Virtuosa_Gold_v4.10a_Phoenix_Edition_patch.exe Risk: Low Name: Not-A-Virus.VirTool.Win32.AvSpoffer.a Path: C:\Dokumente und Einstellungen\Mansair\Eigene Dateien\Downloads\Programme\virtuosa\VirtuosaGold4[1].x(PhoenixEdition)\LS_Virtuosa_Gold_v4.X_Phoenix_Edition_Patch.exe Risk: Low Name: Not-A-Virus.VirTool.Win32.AvSpoffer.a Path: C:\Dokumente und Einstellungen\Mansair\Eigene Dateien\Downloads\Programme\virtuosa\VirtuosaGold4[1].x(PhoenixEdition).zip/LS_Virtuosa_Gold_v4.X_Phoenix_Edition_Patch.exe Risk: Low Name: Adware.Maxifiles Path: C:\System Volume Information\_restore{77F3C9AD-D71C-4E08-8A03-ECB919E6ACB1}\RP223\A0038711.exe Risk: Medium Name: Adware.Maxifiles Path: C:\System Volume Information\_restore{77F3C9AD-D71C-4E08-8A03-ECB919E6ACB1}\RP226\A0038810.exe Risk: Medium Name: Adware.Maxifiles Path: C:\System Volume Information\_restore{77F3C9AD-D71C-4E08-8A03-ECB919E6ACB1}\RP227\A0039616.exe Risk: Medium Name: Adware.Softomate Path: C:\System Volume Information\_restore{77F3C9AD-D71C-4E08-8A03-ECB919E6ACB1}\RP227\A0039628.exe Risk: Medium Name: Not-A-Virus.Downloader.Win32.WinFixer.o Path: C:\WINDOWS\Downloaded Program Files\UWA6PU_0001_N91M2107NetInstaller.exe Risk: Low Name: Not-A-Virus.Downloader.Win32.WinFixer.o Path: C:\WINDOWS\Downloaded Program Files\UWA6P_0001_N91M1807NetInstaller.exe Risk: Low Name: Hijacker.Costrat.r Path: C:\WINDOWS\system32:lzx32.sys Risk: High |
|
|
|
|
|
|
29.11.2006, 17:43
Ehrenmitglied
Beiträge: 29434 |
#8
Start > Ausfuehren --> reinschreiben --> cmd
und ok. kopiere rein Zitat dir /s /a "c:\lzx32*.*" > c:\find.txt & start notepad c:\find.txtund poste alles, was im Texteditor erscheint ------------------------------------------------------- Download Registry Search by Bobbi Flekman http://virus-protect.org/artikel/tools/regsearch.html und doppelklicken, um zu starten. in: "Enter search strings" (reinschreiben oder reinkopieren) lzx32.sys in edit und klicke "Ok". Notepad wird sich öffnen -- kopiere den Text ab und poste ihn. __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
29.11.2006, 18:54
Member
Themenstarter Beiträge: 17 |
#9
Volume in Laufwerk C: hat keine Bezeichnung.
Volumeseriennummer: A040-88CD REGEDIT4 ; Registry Search 2.0 by Bobbi Flekman © 2005 ; Version: 2.0.1.0 ; Results at 29.11.2006 18:53:13 for strings: ; 'lzx32.sys' ; Strings excluded from search: ; (None) ; Search in: ; Registry Keys Registry Values Registry Data ; HKEY_LOCAL_MACHINE HKEY_USERS ; End Of The Log... |
|
|
|
|
|
|
29.11.2006, 19:12
Ehrenmitglied
Beiträge: 29434 |
#10
hast du alles loeschen lassen nach dem ewido-scan ??
"remove infections" klicken ** poste das neue log vom HijackThis __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
09.12.2006, 20:42
...neu hier
Beiträge: 1 |
#11
Hallo,
Virus kann sehr einfach mit SmitfraufFix entfernt werden. http://siri.urz.free.fr/Fix/smitfraudfix.exe gruß Frank |
|
|
|
|
|
|
09.12.2006, 21:14
Ehrenmitglied
Beiträge: 29434 |
#12
xyzfrank001
was soll der Unsinn ?? wir versuchen einen rootkit zu loeschen ! - lzx32.sys und der smitfraudfix wurde (siehe oben) bereits angewendet. __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
31.12.2006, 12:55
...neu hier
Beiträge: 4 |
#13
Hiiiiiiiilfe bin neu hier und brauche unbedingt hilfe.....habe mir den virus burster 6.3 eingefangen und habe absolut keine ahnung wie ich den weg bekomme..Bitte hilft mir.....Vielen Dank schonmal im vorraus
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "C-Media Mixer"="Mixer.exe /startup" "ICQ Lite"="\"C:\\Programme\\ICQLite\\ICQLite.exe\" -minimize" "SunJavaUpdateSched"="C:\\Programme\\Java\\jre1.5.0_06\\bin\\jusched.exe" "WinampAgent"="C:\\Programme\\Winamp\\winampa.exe" "LVCOMSX"="C:\\WINDOWS\\System32\\LVCOMSX.EXE" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "VirusBurster"="C:\\Programme\\VirusBurster\\virusburster.exe /h" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="Die derzeitige Homepage" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,23,00,00,00,7c,00,00,00,72,00,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" "{01b55afa-f451-474b-9e91-c35b24d02641}"="boob" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Completion time: 06-12-31 12:21:59.43 C:\ComboFix.txt ... 06-12-31 12:21 |
|
|
|
|
|
|
31.12.2006, 13:53
Ehrenmitglied
Beiträge: 29434 |
#14
MrStyles
ich brauche das komplette log von combofix + das log vom HijacktHis http://virus-protect.org/hjtkurz.html __________ MfG Sabina rund um die PC-Sicherheit |
|
|
|
|
|
|
31.12.2006, 16:38
...neu hier
Beiträge: 4 |
#15
Ok hier einmal vom combofix.....
ComboFix 06.11.27 - Running from: "C:\Dokumente und Einstellungen\Administrator\Desktop" ((((((((((((((((((((((((((((((( Files Created from 2006-11-31 to 2006-12-31 )))))))))))))))))))))))))))))))))) 2006-12-31 12:24 <DIR> d-------- C:\Programme\Mythicsoft 2006-12-31 12:05 <DIR> d-------- C:\Programme\CleanUp! 2006-12-21 13:41 <DIR> d---s---- C:\Dokumente und Einstellungen\Administrator\UserData 2006-12-16 12:53 19,456 --a------ C:\WINDOWS\system32\qrzsyr.dll 2006-12-16 12:53 <DIR> d-------- C:\Programme\VirusBurster 2006-12-16 12:53 <DIR> d-------- C:\Programme\Video ActiveX Object 2006-12-11 18:30 <DIR> d-------- C:\WINDOWS\LastGood 2006-12-04 14:55 <DIR> d-------- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Ahead (((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))) 2006-12-30 20:05 -------- d-------- C:\Programme\Mozilla Firefox 2006-12-22 13:20 -------- d-------- C:\Programme\Gemeinsame Dateien\Microsoft Shared 2006-11-28 14:12 -------- d-------- C:\Programme\Allok Video to 3GP Converter 2006-11-28 13:17 -------- d-------- C:\Programme\ImTOO 2006-11-28 13:01 -------- d-------- C:\Programme\Gemeinsame Dateien\Teleca Shared 2006-11-28 13:00 -------- d-------- C:\Programme\Sony Ericsson 2006-11-28 13:00 -------- d-------- C:\Programme\Gemeinsame Dateien 2006-11-28 12:58 -------- d-------- C:\Programme\Gemeinsame Dateien\InstallShield 2006-11-28 12:51 -------- d--h----- C:\Programme\WindowsUpdate 2006-11-23 18:24 -------- d-------- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Help 2006-11-21 18:38 -------- d---s---- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Microsoft 2006-11-01 16:36 -------- d-------- C:\Programme\concept design (((((((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries are not shown [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe" "MsnMsgr"="\"C:\\Programme\\MSN Messenger\\MsnMsgr.Exe\" /background" "BitTorrent"="\"C:\\Programme\\BitTorrent\\bittorrent.exe\" --force_start_minimized" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\runonce] "ICQ Lite"="C:\\Programme\\ICQLite\\ICQLite.exe -trayboot" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "C-Media Mixer"="Mixer.exe /startup" "ICQ Lite"="\"C:\\Programme\\ICQLite\\ICQLite.exe\" -minimize" "SunJavaUpdateSched"="C:\\Programme\\Java\\jre1.5.0_06\\bin\\jusched.exe" "WinampAgent"="C:\\Programme\\Winamp\\winampa.exe" "LVCOMSX"="C:\\WINDOWS\\System32\\LVCOMSX.EXE" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "VirusBurster"="C:\\Programme\\VirusBurster\\virusburster.exe /h" [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components] "DeskHtmlVersion"=dword:00000110 "DeskHtmlMinorVersion"=dword:00000005 "Settings"=dword:00000001 "GeneralFlags"=dword:00000001 [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="Die derzeitige Homepage" "Flags"=dword:00000002 "Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\ 00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00 "CurrentState"=hex:04,00,00,40 "OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\ ff,ff,04,00,00,00 "RestoredStateInfo"=hex:18,00,00,00,f2,01,00,00,23,00,00,00,7c,00,00,00,72,00,\ 00,00,01,00,00,00 [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler] "{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader" "{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon" "{01b55afa-f451-474b-9e91-c35b24d02641}"="boob" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"="" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "dontdisplaylastusername"=dword:00000000 "legalnoticecaption"="" "legalnoticetext"="" "shutdownwithoutlogon"=dword:00000001 "undockwithoutlogon"=dword:00000001 [HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer] "NoDriveTypeAutoRun"=dword:00000091 [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload] "PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}" "CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}" "WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" "SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" Completion time: 06-12-31 16:36:14.35 C:\ComboFix.txt ... 06-12-31 16:36 C:\ComboFix2.txt ... 06-12-31 12:21 und hier vom hijackthis....... Logfile of HijackThis v1.99.1 Scan saved at 16:38:48, on 31.12.2006 Platform: Windows XP (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 (6.00.2600.0000) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wdfmgr.exe C:\WINDOWS\Mixer.exe C:\Programme\ICQLite\ICQLite.exe C:\Programme\Java\jre1.5.0_06\bin\jusched.exe C:\Programme\Winamp\winampa.exe C:\WINDOWS\System32\LVCOMSX.EXE C:\WINDOWS\System32\ctfmon.exe C:\Programme\Internet Explorer\iexplore.exe C:\Programme\Internet Explorer\iexplore.exe C:\Dokumente und Einstellungen\Administrator\Desktop\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://google.icq.com/search/search_frame.php R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://google.icq.com O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx O3 - Toolbar: ICQ Toolbar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQToolbar\toolbaru.dll O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup O4 - HKLM\..\Run: [ICQ Lite] "C:\Programme\ICQLite\ICQLite.exe" -minimize O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe O4 - HKLM\..\Run: [LVCOMSX] C:\WINDOWS\System32\LVCOMSX.EXE O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [VirusBurster] C:\Programme\VirusBurster\virusburster.exe /h O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe O4 - HKCU\..\Run: [MsnMsgr] "C:\Programme\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [BitTorrent] "C:\Programme\BitTorrent\bittorrent.exe" --force_start_minimized O4 - HKCU\..\RunOnce: [ICQ Lite] C:\Programme\ICQLite\ICQLite.exe -trayboot O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_06\bin\ssv.dll O9 - Extra button: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Programme\ICQLite\ICQLite.exe O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm O17 - HKLM\System\CCS\Services\Tcpip\..\{4A936C81-7DDD-4742-90B3-A18D1B13569A}: NameServer = 85.255.115.45,85.255.112.215 O17 - HKLM\System\CCS\Services\Tcpip\..\{599CAF47-31F8-420F-8EE9-ECA5ACDEA737}: NameServer = 85.255.115.45,85.255.112.215 O17 - HKLM\System\CCS\Services\Tcpip\..\{C8354C0E-0788-42FA-AD58-794F7DC41787}: NameServer = 85.255.115.45,85.255.112.215 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 85.255.115.45 85.255.112.215 O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 85.255.115.45 85.255.112.215 O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 85.255.115.45 85.255.112.215 « |
|
|
|
|
|
Um auf dieses Thema zu ANTWORTEN
bitte erst » hier kostenlos registrieren!!
bitte erst » hier kostenlos registrieren!!
Folgende Themen könnten Dich auch interessieren:
Copyright © 2024, Protecus.de - Protecus Team - Impressum / Mediadaten
Habe leider auch diesen doofen Befall von Virus Burster
Hier mein Combofix Log:
Mansair - 06-11-28 12:08:04.70 Service Pack 1
ComboFix 06.11.27W - Running from: "C:\Dokumente und Einstellungen\Mansair\Desktop"
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\system32\ishost.exe
C:\WINDOWS\system32\ismini.exe
C:\WINDOWS\system32\isnotify.exe
C:\WINDOWS\system32\issearch.exe
C:\WINDOWS\system32\ixt0.dll
C:\Programme\Inetget2
C:\Programme\Ipwins
C:\Programme\Safety Bar
C:\WINDOWS\system32\components
C:\Programme\Gemeinsame Dateien\{304088CD-0C78-2055-0322-040313200029}
C:\Programme\Gemeinsame Dateien\{A04088CD-0C78-2055-0322-040313200029}
((((((((((((((((((((((((((((((( Files Created from 2006-10-28 to 2006-11-28 ))))))))))))))))))))))))))))))))))
2006-11-28 08:05 <DIR> d-------- C:\Programme\CleanUp!
2006-11-28 07:48 <DIR> d-------- C:\Dokumente und Einstellungen\Mansair\Anwendungsdaten\SearchToolbarCorp
2006-11-28 07:47 567,257 ---hs---- C:\WINDOWS\system32\ghhkj.ini2
2006-11-28 07:47 566,070 ---hs---- C:\WINDOWS\system32\ghhkj.bak2
2006-11-28 00:17 <DIR> d-------- C:\Dokumente und Einstellungen\Mansair\Anwendungsdaten\SearchToolbarCorp(2)
2006-11-27 23:54 <DIR> d-------- C:\Programme\Spybot - Search & Destroy
2006-11-27 23:54 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2006-11-27 23:47 <DIR> d-------- C:\Programme\SmartSound Software
2006-11-27 23:47 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SmartSound Software Inc
2006-11-27 23:46 84,992 --a------ C:\WINDOWS\system32\ATL70.DLL
2006-11-27 23:46 77,824 --a------ C:\WINDOWS\system32\tpedvf.dll
2006-11-27 23:46 57,856 --a------ C:\WINDOWS\system32\masd32.dll
2006-11-27 23:46 41,219 --a------ C:\WINDOWS\RSETPATH.exe
2006-11-27 23:46 27,648 --a------ C:\WINDOWS\system32\ma32.dll
2006-11-27 23:46 196,096 --a------ C:\WINDOWS\system32\macd32.dll
2006-11-27 23:46 171,008 --a------ C:\WINDOWS\system32\drivers\MarvinBus.sys
2006-11-27 23:46 138,752 --a------ C:\WINDOWS\system32\mase32.dll
2006-11-27 23:46 136,192 --a------ C:\WINDOWS\system32\mamc32.dll
2006-11-27 23:46 <DIR> d-------- C:\Programme\Virus-Bursters
2006-11-27 23:45 964,608 --a------ C:\WINDOWS\system32\MFC70U.DLL
2006-11-27 23:45 88,340 --a------ C:\WINDOWS\system32\qbdrlhek.exe
2006-11-27 23:45 704,564 ---hs---- C:\WINDOWS\system32\jkhhg.dll
2006-11-27 23:45 65,536 --a------ C:\WINDOWS\system32\MFC71DEU.DLL
2006-11-27 23:45 565,461 ---hs---- C:\WINDOWS\system32\ghhkj.bak1
2006-11-27 23:45 54,784 --a------ C:\WINDOWS\system32\MSVCI70.DLL
2006-11-27 23:45 499,712 --a------ C:\WINDOWS\system32\msvcp71.dll
2006-11-27 23:45 42,516 --a------ C:\WINDOWS\system32\suoledgh.dll
2006-11-27 23:45 348,160 --a------ C:\WINDOWS\system32\msvcr71.dll
2006-11-27 23:45 126,996 --a------ C:\WINDOWS\system32\qlujsolw.dll
2006-11-27 23:45 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2006-11-27 23:45 1,047,552 --a------ C:\WINDOWS\system32\MFC71u.dll
2006-11-27 23:45 <DIR> d-------- C:\Programme\VSAdd-in
2006-11-27 23:44 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Pinnacle Studio
2006-11-27 23:40 71,168 --a------ C:\WINDOWS\system32\drvlul.dll
2006-11-27 23:40 40,973 ---hs---- C:\WINDOWS\system32\ssqpool.dll
2006-11-27 23:40 17,408 --a------ C:\WINDOWS\system32\winzwr32.dll
2006-11-27 23:39 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Pinnacle
2006-11-27 18:03 <DIR> d-------- C:\Programme\Smart Projects
2006-11-24 17:13 <DIR> d-------- C:\Programme\Streambox
2006-11-24 13:20 <DIR> d-------- C:\Programme\WebReaper
2006-11-22 18:38 29,696 --------- C:\WINDOWS\system32\drivers\rndismpx.sys
2006-11-22 18:38 12,032 --------- C:\WINDOWS\system32\drivers\usb8023x.sys
2006-11-22 18:17 <DIR> d-------- C:\9a7554344369b670ab4c86
2006-11-22 18:10 <DIR> d-------- C:\WINDOWS\Minidump
2006-11-21 20:37 <DIR> d-------- C:\Programme\Microsoft ActiveSync
2006-11-14 23:50 <DIR> d-------- C:\Programme\AIST
2006-11-09 23:18 48,640 --------- C:\WINDOWS\AKDeInstall.exe
2006-11-09 23:18 <DIR> d-------- C:\Programme\Yokey Software
2006-10-31 19:23 57,968 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2006-10-31 19:23 4,032 --a------ C:\WINDOWS\system32\SYMEVNT1.DLL
2006-10-31 19:23 36,864 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2006-10-31 19:23 <DIR> d-------- C:\WINDOWS\Command
2006-10-31 18:04 <DIR> d-------- C:\Dokumente und Einstellungen\Mansair\Anwendungsdaten\Symantec
2006-10-31 18:03 <DIR> d-------- C:\Programme\Symantec
2006-10-31 18:03 <DIR> d-------- C:\Programme\Gemeinsame Dateien\Symantec Shared
2006-10-31 18:03 <DIR> d-------- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Symantec
2006-10-30 19:19 <DIR> d-------- C:\Programme\ASUS
2006-10-30 19:10 996,872 --a------ C:\WINDOWS\system\CP3240MT.DLL
2006-10-30 19:10 6,272 --a------ C:\WINDOWS\system32\drivers\ASLM75.SYS
2006-10-30 19:10 458,752 --a------ C:\WINDOWS\system\COMCTL32.DLL
2006-10-30 19:10 299,008 --a------ C:\WINDOWS\uninst.exe
2006-10-30 19:10 29,952 --a------ C:\WINDOWS\system\BORLNDMM.DLL
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2006-11-28 12:11 -------- d-------- C:\Programme\Gemeinsame Dateien
2006-11-27 23:54 -------- d--h----- C:\Programme\InstallShield Installation Information
2006-11-27 23:54 -------- d-------- C:\Programme\Pinnacle
2006-11-27 23:46 87 --a------ C:\AUTOEXEC.BAT
2006-11-27 17:57 -------- d-------- C:\Dokumente und Einstellungen\Mansair\Anwendungsdaten\uTorrent
2006-11-27 13:01 -------- d-------- C:\Dokumente und Einstellungen\Mansair\Anwendungsdaten\Adobe
2006-11-27 12:47 30864 --a------ C:\Dokumente und Einstellungen\Mansair\Anwendungsdaten\GDIPFONTCACHEV1.DAT
2006-11-22 12:48 -------- d-------- C:\Programme\freeCommander2006
2006-11-21 20:41 -------- d---s---- C:\Dokumente und Einstellungen\Mansair\Anwendungsdaten\Microsoft
2006-11-21 20:39 2508 --a------ C:\Dokumente und Einstellungen\Mansair\Anwendungsdaten\$_hpcst$.hpc
2006-11-21 20:37 -------- d-------- C:\Programme\Gemeinsame Dateien\Microsoft Shared
2006-11-19 15:28 -------- d-------- C:\Programme\TKB e-banking
2006-11-13 12:52 -------- d-------- C:\Programme\MSN Messenger
2006-11-02 00:10 -------- d-------- C:\Programme\Macromedia
2006-11-02 00:10 -------- d-------- C:\Programme\Gemeinsame Dateien\Macromedia
2006-10-31 16:52 -------- d-------- C:\Programme\Google
2006-10-27 19:21 -------- d-------- C:\Programme\Kabelloser Labtec-Desktop
2006-10-24 10:17 48424 --a------ C:\WINDOWS\system32\sirenacm.dll
2006-10-23 17:43 -------- d-------- C:\Programme\Jingle Palette
2006-10-16 16:52 -------- d-------- C:\Programme\SmartFTP Client 2.0
2006-10-16 16:51 -------- d-------- C:\Dokumente und Einstellungen\Mansair\Anwendungsdaten\SmartFTP
2006-10-16 16:50 -------- d-------- C:\Programme\SmartFTP Client 2.0 Setup Files
2006-10-16 16:50 -------- d-------- C:\Programme\SmartFTP
2006-10-16 16:48 -------- d-------- C:\Programme\SmartFTP Client Setup Files
2006-10-15 16:10 -------- d--h----- C:\Programme\Zero G Registry
2006-10-15 13:28 -------- d-------- C:\Programme\Railroad Tycoon II - Platinum
2006-10-02 17:30 20727 --a------ C:\Dokumente und Einstellungen\Mansair\Anwendungsdaten\FCVIS.INI
2006-10-02 17:17 -------- d-------- C:\Dokumente und Einstellungen\Mansair\Anwendungsdaten\capella-software
2006-10-02 12:12 -------- d-------- C:\Programme\capella-software
2006-10-02 12:02 88576 --ah----- C:\Dokumente und Einstellungen\Mansair\Anwendungsdaten\rbap550.dll
2006-10-02 12:02 769 --ah----- C:\Dokumente und Einstellungen\Mansair\Anwendungsdaten\.DiffLogX_V102
2006-10-02 12:02 7320576 --ah----- C:\Dokumente und Einstellungen\Mansair\Anwendungsdaten\Mkz1REALA.dll
2006-10-02 12:02 65536 --ah----- C:\Dokumente und Einstellungen\Mansair\Anwendungsdaten\noBevelButton.DLL
2006-10-02 12:02 57344 --ah----- C:\Dokumente und Einstellungen\Mansair\Anwendungsdaten\groundControl.DLL
2006-10-02 12:02 33792 --ah----- C:\Dokumente und Einstellungen\Mansair\Anwendungsdaten\PLUtil.DLL
2006-10-02 12:02 28160 --ah----- C:\Dokumente und Einstellungen\Mansair\Anwendungsdaten\fcPlacard.DLL
2006-10-02 12:01 5245 --a------ C:\Programme\uninstal.log
2006-10-02 12:01 -------- d-------- C:\Programme\FlightCheck Professional 5.80
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries are not shown
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\ctfmon.exe"
"LogitechSoftwareUpdate"="C:\\Programme\\Logitech\\Video\\ManifestEngine.exe boot"
"MsnMsgr"="\"C:\\Programme\\MSN Messenger\\MsnMsgr.Exe\" /background"
"PcSync"="C:\\Programme\\Nokia\\Nokia PC Suite 6\\PcSync2.exe /NoDialog"
"swg"="C:\\Programme\\Google\\GoogleToolbarNotifier\\1.0.720.3640\\GoogleToolbarNotifier.exe"
"H/PC Connection Agent"="\"C:\\Programme\\Microsoft ActiveSync\\wcescomm.exe\""
"SpybotSD TeaTimer"="C:\\Programme\\Spybot - Search & Destroy\\TeaTimer.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"IgfxTray"="C:\\WINDOWS\\System32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINDOWS\\System32\\hkcmd.exe"
"PRONoMgr.exe"="C:\\Programme\\Intel\\NCS\\PROSet\\PRONoMgr.exe"
"Smapp"="C:\\Programme\\Analog Devices\\SoundMAX\\SMTray.exe"
"LVCOMSX"="C:\\WINDOWS\\System32\\LVCOMSX.EXE"
"LogitechVideoRepair"="C:\\Programme\\Logitech\\Video\\ISStart.exe"
"LogitechVideoTray"="C:\\Programme\\Logitech\\Video\\LogiTray.exe"
"DXM6Patch_981116"="C:\\WINDOWS\\p_981116.exe /Q:A"
"MaxtorOneTouch"="C:\\PROGRA~1\\Maxtor\\OneTouch\\Utils\\OneTouch.exe"
"SunJavaUpdateSched"="\"C:\\Programme\\Java\\jre1.5.0_08\\bin\\jusched.exe\""
"WinampAgent"="C:\\Programme\\Winamp\\winampa.exe"
"iTunesHelper"="\"C:\\Programme\\iTunes\\iTunesHelper.exe\""
"QuickTime Task"="\"C:\\Programme\\QuickTime\\qttask.exe\" -atboottime"
"FreePDF Assistant"="C:\\Programme\\FreePDF_XP\\fpassist.exe"
"TkBellExe"="\"C:\\Programme\\Gemeinsame Dateien\\Real\\Update_OB\\realsched.exe\" -osboot"
"PCSuiteTrayApplication"="C:\\PROGRA~1\\Nokia\\NOKIAP~1\\LAUNCH~1.EXE -startup"
"ASUS Probe"="C:\\Program Files\\ASUS\\Probe\\AsusProb.exe"
"CTDrive"="rundll32.exe C:\\WINDOWS\\System32\\drvlul.dll,startup"
"PinnacleDriverCheck"="C:\\WINDOWS\\System32\\\\PSDrvCheck.exe"
"Virus-Bursters"="C:\\Programme\\Virus-Bursters\\virus-bursters.exe /h"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001
[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Die derzeitige Homepage"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,02,00,00,00,00,00,00,00,02,00,00,de,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
"{1a01a98c-4f25-42e1-971a-185cf63569b2}"="expatriates"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"
"expatriates"="{1a01a98c-4f25-42e1-971a-185cf63569b2}"
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\jkhhg
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winzwr32
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
Completion time: 06-11-28 12:11:14.84
C:\ComboFix.txt ... 06-11-28 12:11